@mnemonik/shared 7.142.0 → 7.143.0

package/src/sourceRedaction.ts

@@ -27,7 +27,15 @@ export async function scrubSourceSecrets(text: string, filePath: string): Promis
           ? 'python'
           : ['.sh', '.bash', '.zsh'].includes(extension)
             ? 'bash'
-            : null;
+            : extension === '.swift'
+              ? 'swift'
+              : extension === '.sql'
+                ? 'sql'
+                : extension === '.lua'
+                  ? 'lua'
+                  : extension === '.rs'
+                    ? 'rust'
+                    : null;
   if (!text || !language || Buffer.byteLength(text, 'utf8') > MAX_AST_PARSE_BYTES) {
     return scrubPayload(text);
   }
@@ -41,10 +49,19 @@ export async function scrubSourceSecrets(text: string, filePath: string): Promis
     tree = parser.parse(text);
     if (!tree || tree.rootNode.hasError) return scrubPayload(text);
     const root = tree.rootNode;
+
     const redacted =
       language === 'bash'
         ? redactShellNode(root, commandLineCredentialRanges(text))
-        : redactNode(root);
+        : language === 'swift'
+          ? redactSwiftNode(root)
+          : language === 'sql'
+            ? redactSqlNode(root)
+            : language === 'lua'
+              ? redactLuaNode(root)
+              : language === 'rust'
+                ? redactRustNode(root)
+                : redactNode(root);
     return text.slice(0, root.startIndex) + redacted + text.slice(root.endIndex);
   } catch {
     return scrubPayload(text);
@@ -54,6 +71,378 @@ export async function scrubSourceSecrets(text: string, filePath: string): Promis
   }
 }
 
+/** Rust raw/byte prefixes belong to the delimiter, never to the credential payload. */
+function redactRustNode(node: Node, sensitive = false, labeled = new Set<number>()): string {
+  sensitive ||= labeled.has(node.id);
+  const original = node.text;
+  const type = node.type;
+  if (type === 'line_comment') return '//' + scrubPayload(original.slice(2));
+  if (type === 'block_comment') return '/*' + scrubPayload(original.slice(2, -2)) + '*/';
+  if (sensitive && ['integer_literal', 'float_literal', 'char_literal'].includes(type))
+    return '"' + redactSecretValue(original) + '"';
+  if (type === 'string_literal' || type === 'raw_string_literal') {
+    const start = original.indexOf('"') + 1;
+    const end = original.lastIndexOf('"');
+    return (
+      original.slice(0, start) +
+      literalPayload(original.slice(start, end), sensitive) +
+      original.slice(end)
+    );
+  }
+  const label = (key: Node | null): boolean => {
+    if (!key) return false;
+    const name = (key.childForFieldName('field') ?? key).text;
+    return SECRET_LABEL_RE.test(
+      ['string_literal', 'raw_string_literal'].includes(key.type)
+        ? name.slice(name.indexOf('"') + 1, name.lastIndexOf('"'))
+        : name.replace(/^r#/, '')
+    );
+  };
+  const mark = (pattern: Node | null, value: Node | null): void => {
+    if (!pattern || !value) return;
+    if (['ref_pattern', 'mut_pattern', 'reference_pattern'].includes(pattern.type)) {
+      mark(pattern.firstNamedChild, value);
+      return;
+    }
+    if (label(pattern)) labeled.add(value.id);
+    else if (pattern.type === 'tuple_pattern' && value.type === 'tuple_expression')
+      pattern.namedChildren.forEach((part, index) =>
+        mark(part, value.namedChildren[index] ?? null)
+      );
+  };
+  if (type === 'let_declaration')
+    mark(node.childForFieldName('pattern'), node.childForFieldName('value'));
+  if (type === 'const_item' || type === 'static_item')
+    mark(node.childForFieldName('name'), node.childForFieldName('value'));
+  if (type === 'field_initializer')
+    mark(node.childForFieldName('field'), node.childForFieldName('value'));
+  if (type === 'assignment_expression')
+    mark(node.childForFieldName('left'), node.childForFieldName('right'));
+  // Attribute/macro arguments are token trees, but literal key/value boundaries remain explicit.
+  if (type === 'token_tree') {
+    const children = node.children.filter(
+      (child) => !['line_comment', 'block_comment'].includes(child.type)
+    );
+    let valueSensitive = sensitive;
+    let genericDepth = 0;
+    for (const [index, child] of children.entries()) {
+      const previous = children[index - 1];
+      // Token trees flatten type arguments too. Their commas and associated-type
+      // bindings are not macro value boundaries; const arguments are not values.
+      if (
+        child.text === '<' &&
+        (genericDepth > 0 || ['::', '=', ':', '('].includes(previous?.text ?? ''))
+      ) {
+        genericDepth++;
+        continue;
+      }
+      if (genericDepth > 0) {
+        if (child.text === '>' || child.text === '>>') genericDepth -= child.text.length;
+        genericDepth = Math.max(0, genericDepth);
+        continue;
+      }
+      const nextKey = children[index + 1];
+      const nextBinding =
+        nextKey &&
+        ['identifier', 'string_literal', 'raw_string_literal'].includes(nextKey.type) &&
+        ['=', ':'].includes(children[index + 2]?.text ?? '');
+      if (child.text === ';' || (child.text === ',' && nextBinding)) valueSensitive = sensitive;
+      else if (['=', ':'].includes(child.text) && label(previous ?? null)) valueSensitive = true;
+      else if (valueSensitive) {
+        const callArguments =
+          child.type === 'token_tree' &&
+          child.text.startsWith('(') &&
+          (previous?.type === 'identifier' ||
+            ['>', ')', ']'].includes(previous?.text.at(-1) ?? ''));
+        const key = children[index + 1]?.text === ':';
+        if (!callArguments && !key) labeled.add(child.id);
+      }
+    }
+  }
+  let result = '';
+  let offset = node.startIndex;
+  for (const child of node.namedChildren) {
+    result += original.slice(offset - node.startIndex, child.startIndex - node.startIndex);
+    // Carry a secret label through value wrappers, never into runtime call arguments/conditions.
+    const carry =
+      sensitive &&
+      ([
+        'parenthesized_expression',
+        'unary_expression',
+        'binary_expression',
+        'field_expression',
+        'reference_expression',
+        'try_expression',
+        'await_expression',
+        'block',
+        'expression_statement',
+        'else_clause',
+        'tuple_expression',
+        'array_expression',
+      ].includes(type) ||
+        (type === 'call_expression' && child.id === node.childForFieldName('function')?.id) ||
+        (type === 'match_expression' && child.id === node.childForFieldName('body')?.id) ||
+        type === 'match_block' ||
+        (type === 'match_arm' && child.id === node.childForFieldName('value')?.id) ||
+        (type === 'type_cast_expression' && child.id === node.childForFieldName('value')?.id) ||
+        (type === 'if_expression' && child.id !== node.childForFieldName('condition')?.id));
+    result += redactRustNode(child, carry, labeled);
+    offset = child.endIndex;
+  }
+  return result + original.slice(offset - node.startIndex);
+}
+
+/** Lua exposes payload spans for both quoted and level-matched long-bracket literals. */
+function redactLuaNode(node: Node, sensitive = false, labeled = new Set<number>()): string {
+  sensitive ||= labeled.has(node.id);
+  const original = node.text;
+  if (node.type === 'string' || node.type === 'comment') {
+    const content = node.childForFieldName('content');
+    if (!content) return original;
+    const suffix = original.slice(content.endIndex - node.startIndex);
+    let payload =
+      node.type === 'comment'
+        ? scrubPayload(content.text)
+        : literalPayload(content.text, sensitive);
+    if (payload !== content.text && suffix.startsWith(']')) {
+      // A placeholder must not introduce a closing long bracket, including at the boundary.
+      payload = payload.split(suffix).join('] ' + suffix.slice(1));
+      if ((payload + suffix).indexOf(suffix) < payload.length) payload += ' ';
+    }
+    return original.slice(0, content.startIndex - node.startIndex) + payload + suffix;
+  }
+  if (node.type === 'number' && sensitive) return "'" + redactSecretValue(original) + "'";
+  const label = (key: Node | null): boolean => {
+    if (key?.type === 'bracket_index_expression') {
+      const field = key.childForFieldName('field');
+      return field?.type === 'string' && secretLabel(field);
+    }
+    return secretLabel(key?.type === 'dot_index_expression' ? key.childForFieldName('field') : key);
+  };
+  if (node.type === 'assignment_statement') {
+    const names =
+      node.namedChildren.find((child) => child.type === 'variable_list')?.namedChildren ?? [];
+    const values =
+      node.namedChildren.find((child) => child.type === 'expression_list')?.namedChildren ?? [];
+    values.forEach((value, index) => {
+      if (label(names[index] ?? null)) labeled.add(value.id);
+    });
+  } else if (node.type === 'field' && label(node.childForFieldName('name'))) {
+    const value = node.childForFieldName('value');
+    if (value) labeled.add(value.id);
+  }
+  const carry =
+    sensitive &&
+    (node.type === 'parenthesized_expression' ||
+      node.type === 'unary_expression' ||
+      (node.type === 'binary_expression' &&
+        ['..', 'and', 'or'].includes(node.childForFieldName('operator')?.text ?? '')));
+  let result = '';
+  let offset = node.startIndex;
+  for (const child of node.namedChildren) {
+    result += original.slice(offset - node.startIndex, child.startIndex - node.startIndex);
+    result += redactLuaNode(child, carry, labeled);
+    offset = child.endIndex;
+  }
+  return result + original.slice(offset - node.startIndex);
+}
+
+function sqlSecretLabel(node: Node | null): boolean {
+  if (!node) return false;
+  if (['field', 'object_reference', 'column'].includes(node.type))
+    return sqlSecretLabel(node.childForFieldName('name') ?? node.firstNamedChild);
+  // This dialect-neutral grammar sometimes calls PostgreSQL quoted identifiers literals.
+  if (node.type === 'identifier' || (node.type === 'literal' && node.text.startsWith('"')))
+    return SECRET_LABEL_RE.test(node.text.replace(/^"|"$/g, '').replaceAll('""', '"'));
+  return false;
+}
+
+function redactSqlNode(node: Node, sensitive = false): string {
+  if (node.type === 'create_function') {
+    const language = node.namedChildren.find((child) => child.type === 'function_language');
+    const body = node.namedChildren.find((child) => child.type === 'function_body');
+    // Opaque/procedural bodies have no established inner syntax; the caller uses fallback.
+    if (
+      language?.namedChildren.find((child) => child.type === 'identifier')?.text.toLowerCase() !==
+        'sql' ||
+      body?.namedChildren.some((child) => child.type === 'literal')
+    )
+      throw new Error('Opaque SQL function body');
+  }
+  const original = node.text;
+  if (node.type === 'comment') return '--' + scrubPayload(original.slice(2));
+  if (node.type === 'marginalia') return '/*' + scrubPayload(original.slice(2, -2)) + '*/';
+  if (node.type === 'literal') {
+    if (original.startsWith('"')) return original; // PostgreSQL identifier, never a secret value.
+    const opening = /^(?:[eEnNbBxX]|[uU]&)?'|^\$[A-Za-z_0-9]*\$/.exec(original)?.[0];
+    if (opening) {
+      const closing = opening.startsWith('$') ? opening : "'";
+      if (!original.endsWith(closing)) throw new Error('Incomplete SQL literal');
+      const payload = original.slice(opening.length, -closing.length);
+      // Scrub the whole payload on a match: SQL doubled quotes must not leave a secret suffix.
+      const redacted = literalPayload(payload, sensitive);
+      return opening + (redacted === payload ? payload : redactSecretValue(payload)) + closing;
+    }
+    if (node.namedChildren.some((child) => child.type.startsWith('keyword_'))) return original;
+    if (/^[+\-\d.]/.test(original))
+      return sensitive ? "'" + redactSecretValue(original) + "'" : original;
+    // shortcut: unrecognized typed literals use fallback until their boundaries are established.
+    throw new Error('Unsupported SQL literal');
+  }
+  const left = node.childForFieldName('left');
+  const right = node.childForFieldName('right');
+  const labeled = ['assignment', 'binary_expression'].includes(node.type) && sqlSecretLabel(left);
+  const columnLabel =
+    node.type === 'column_definition' && sqlSecretLabel(node.childForFieldName('name'));
+  const argumentLabel =
+    node.type === 'function_argument' &&
+    sqlSecretLabel(node.namedChildren.find((child) => child.type === 'identifier') ?? null);
+  const aliasLabel = node.type === 'term' && sqlSecretLabel(node.childForFieldName('alias'));
+  const insert = node.type === 'list' && node.parent?.type === 'insert' ? node.parent : null;
+  const columns = insert?.namedChildren.find((child) => child.type === 'list');
+  const columnValues =
+    columns?.namedChildren.some((child) => child.type === 'column') && columns.id !== node.id
+      ? columns.namedChildren.filter((child) => !['comment', 'marginalia'].includes(child.type))
+      : [];
+
+  let result = '';
+  let offset = node.startIndex;
+  let index = 0;
+  let previous: Node | null = null;
+  for (const child of node.namedChildren) {
+    result += original.slice(offset - node.startIndex, child.startIndex - node.startIndex);
+    const carry =
+      sensitive &&
+      ((node.type === 'binary_expression' && node.childForFieldName('operator')?.text === '||') ||
+        (node.type === 'cast' &&
+          child.id ===
+            (
+              node.childForFieldName('parameter') ??
+              node.namedChildren.find((part) => !['comment', 'marginalia'].includes(part.type))
+            )?.id) ||
+        ['list', 'array', 'parenthesized_expression'].includes(node.type) ||
+        (node.type === 'case' &&
+          (previous?.type === 'keyword_then' || previous?.type === 'keyword_else')));
+    result += redactSqlNode(
+      child,
+      carry ||
+        (labeled && child.id === right?.id) ||
+        (node.type === 'binary_expression' && sqlSecretLabel(right) && child.id === left?.id) ||
+        (columnLabel && previous?.type === 'keyword_default') ||
+        (argumentLabel && child.type === 'literal') ||
+        (aliasLabel && child.id === node.childForFieldName('value')?.id) ||
+        child.id === node.childForFieldName('password')?.id ||
+        sqlSecretLabel(columnValues[index] ?? null)
+    );
+    if (!['comment', 'marginalia'].includes(child.type)) {
+      previous = child;
+      index++;
+    }
+    offset = child.endIndex;
+  }
+  return result + original.slice(offset - node.startIndex);
+}
+
+function swiftSecretLabel(node: Node | null): boolean {
+  if (!node) return false;
+  if (node.type.endsWith('string_literal')) {
+    const opening = /^(#+)?("""|")/.exec(node.text);
+    return Boolean(
+      opening && SECRET_LABEL_RE.test(node.text.slice(opening[0].length, -opening[0].length))
+    );
+  }
+  if (['simple_identifier', 'type_identifier'].includes(node.type))
+    return SECRET_LABEL_RE.test(node.text.replace(/^`|`$/g, ''));
+  return swiftSecretLabel(
+    node.childForFieldName('suffix') ??
+      node.childForFieldName('bound_identifier') ??
+      node.childForFieldName('name') ??
+      node.firstNamedChild
+  );
+}
+
+function redactSwiftNode(node: Node, sensitive = false): string {
+  const original = node.text;
+  if (node.type === 'comment' || node.type === 'multiline_comment') {
+    // Swift permits nested block comments; retain every delimiter from the parsed comment.
+    return original
+      .split(/(\/\*|\*\/)/)
+      .map((part) => (part === '/*' || part === '*/' ? part : scrubPayload(part)))
+      .join('');
+  }
+  if (
+    ['line_string_literal', 'multi_line_string_literal', 'raw_string_literal'].includes(node.type)
+  ) {
+    const opening = /^(#+)?("""|")/.exec(original);
+    if (!opening) throw new Error('Swift string delimiter unavailable');
+    const closing = opening[2] + (opening[1] ?? '');
+    if (!original.endsWith(closing)) throw new Error('Swift string is incomplete');
+    const payload = (text: string): string => {
+      if (opening[2] !== '"""') return literalPayload(text, sensitive);
+      // Keep required opening newlines/closing indentation; scrub multiline secrets together.
+      const leading = /^\s*/.exec(text)?.[0] ?? '';
+      const body = text.slice(leading.length);
+      const trailing = /\s*$/.exec(body)?.[0] ?? '';
+      return (
+        leading + literalPayload(body.slice(0, body.length - trailing.length), sensitive) + trailing
+      );
+    };
+    let result = opening[0];
+    let offset = node.startIndex + opening[0].length;
+    for (const child of node.children) {
+      if (!['\\(', ')', 'interpolated_expression', 'raw_str_interpolation'].includes(child.type))
+        continue;
+      result += payload(
+        original.slice(offset - node.startIndex, child.startIndex - node.startIndex)
+      );
+      result += redactSwiftNode(child);
+      offset = child.endIndex;
+    }
+    return result + payload(original.slice(offset - node.startIndex, -closing.length)) + closing;
+  }
+  if (sensitive && ['integer_literal', 'real_literal'].includes(node.type))
+    return '"' + redactSecretValue(original) + '"';
+
+  let labeled =
+    node.type === 'assignment'
+      ? swiftSecretLabel(node.childForFieldName('target'))
+      : node.type === 'value_argument'
+        ? swiftSecretLabel(node.childForFieldName('name'))
+        : false;
+  let result = '';
+  let offset = node.startIndex;
+  for (const [index, child] of node.children.entries()) {
+    const field = node.fieldNameForChild(index);
+    if (
+      (node.type === 'property_declaration' && field === 'name') ||
+      (node.type === 'dictionary_literal' && field === 'key') ||
+      child.type === 'parameter'
+    )
+      labeled = swiftSecretLabel(child);
+    const value =
+      (field === 'value' &&
+        ['property_declaration', 'dictionary_literal', 'value_argument'].includes(node.type)) ||
+      (field === 'result' && node.type === 'assignment') ||
+      field === 'default_value';
+    const carry =
+      sensitive &&
+      ([
+        'tuple_expression',
+        'additive_expression',
+        'nil_coalescing_expression',
+        'try_expression',
+        'await_expression',
+      ].includes(node.type) ||
+        (node.type === 'as_expression' && field === 'expr') ||
+        (node.type === 'prefix_expression' && field === 'target') ||
+        (node.type === 'ternary_expression' && field !== 'condition'));
+    result += original.slice(offset - node.startIndex, child.startIndex - node.startIndex);
+    result += redactSwiftNode(child, carry || (labeled && value));
+    offset = child.endIndex;
+  }
+  return result + original.slice(offset - node.startIndex);
+}
+
 function redactShellNode(
   root: Node,
   ranges: ReturnType<typeof commandLineCredentialRanges>

package/wasm/lua.LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2021 Munif Tanjim
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/wasm/lua.tags.scm

@@ -0,0 +1,36 @@
+(function_declaration
+  name: [
+    (identifier) @name
+    (dot_index_expression
+      field: (identifier) @name)
+  ]) @definition.function
+
+(function_declaration
+  name: (method_index_expression
+    method: (identifier) @name)) @definition.method
+
+(assignment_statement
+  (variable_list
+    .
+    name: [
+      (identifier) @name
+      (dot_index_expression
+        field: (identifier) @name)
+    ])
+  (expression_list
+    .
+    value: (function_definition))) @definition.function
+
+(table_constructor
+  (field
+    name: (identifier) @name
+    value: (function_definition))) @definition.function
+
+(function_call
+  name: [
+    (identifier) @name
+    (dot_index_expression
+      field: (identifier) @name)
+    (method_index_expression
+      method: (identifier) @name)
+  ]) @reference.call

package/wasm/sql.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Derek Stride
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/wasm/sql.tags.scm

@@ -0,0 +1,5 @@
+; Capture whole declarations and their qualified names; references are not declarations.
+(create_table (object_reference) @name) @definition.table
+(create_view (object_reference) @name) @definition.view
+(create_materialized_view (object_reference) @name) @definition.view
+(create_function (object_reference) @name) @definition.function

package/wasm/swift.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 alex-pinkus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/wasm/swift.tags.scm

@@ -0,0 +1,11 @@
+; Upstream 0.7.3 tags capture the enclosing class as a method definition.
+; Capture each declaration itself so chunks retain its exact line range.
+(class_declaration name: (type_identifier) @name) @definition.class
+(protocol_declaration name: (type_identifier) @name) @definition.interface
+(source_file (function_declaration name: (simple_identifier) @name) @definition.function)
+(class_body (function_declaration name: (simple_identifier) @name) @definition.method)
+(enum_class_body (function_declaration name: (simple_identifier) @name) @definition.method)
+(protocol_body (protocol_function_declaration name: (simple_identifier) @name) @definition.method)
+(init_declaration "init" @name) @definition.method
+(deinit_declaration "deinit" @name) @definition.method
+(typealias_declaration name: (type_identifier) @name) @definition.type